Security Advisories | GitStock

high2026-09-08

CVE-2026-84375-js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

nodeca/js-yaml · GHSA-2883-xcg3-v3hh

medium2026-09-08

CVE-2026-84308-phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

phpseclib/phpseclib · GHSA-q97c-8qh3-fpc6

high2026-09-08

Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

ueberdosis/tiptap · GHSA-j95f-988m-3j2f

medium2026-09-08

CVE-2026-84365-Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

honojs/hono · GHSA-gqvv-2mrq-wpjv

medium2026-09-08

CVE-2026-84364-Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

honojs/hono · GHSA-g6gw-c38x-mqfc

medium2026-09-08

CVE-2026-84363-Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

honojs/hono · GHSA-crvj-82cr-hjcx

high2026-09-08

CVE-2026-84445-gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

grpc/grpc-go · GHSA-2v4p-qf9q-27wj

critical2026-09-08

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

vercel/next.js · GHSA-2xp9-vwfh-vxw4

high2026-09-08

CVE-2026-84370-SVGO: removeScripts allows executable links through namespace and control-character bypasses

svg/svgo · GHSA-w27v-7q3p-w38r

medium2026-09-08

CVE-2026-84369-SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

svg/svgo · GHSA-4vpr-x523-8j87

medium2026-09-08

Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature

nodemailer/nodemailer · GHSA-8m3c-c648-2xjj

high2026-09-08

CVE-2026-83616-xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

xmldom/xmldom · GHSA-c7q8-3ch8-vqpv

high2026-09-08

CVE-2026-83617-xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

xmldom/xmldom · GHSA-jxjr-3g7g-3944

high2026-09-08

CVE-2026-83608-xmldom: DocType `name` Injection Bypasses requireWellFormed

xmldom/xmldom · GHSA-27p8-2357-5qqv

high2026-09-08

CVE-2026-83609-xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

xmldom/xmldom · GHSA-3px3-54cx-rmw9

high2026-09-08

CVE-2026-83618-xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

xmldom/xmldom · GHSA-vr34-hp96-76pp

medium2026-09-08

CVE-2026-83611-xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

xmldom/xmldom · GHSA-6h8r-xr42-gp59

high2026-09-08

CVE-2026-83613-xmldom: Quadratic-time attribute deduplication

xmldom/xmldom · GHSA-8344-3jmq-59r6

high2026-09-08

CVE-2026-83619-xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

xmldom/xmldom · GHSA-x4fp-j954-r2f4

high2026-09-08

CVE-2026-83615-xmldom: Quadratic-memory consumption

xmldom/xmldom · GHSA-965w-775f-mr7g

← Previous 1 80 81 82 83 84 1540 Next →